Firewall rule that allow device to access internet only

[xpking]

Dear all,

I have an interface "LAN".
May I know how to set a firewall rule that allow all devices in LAN access internet only, but not inter communication in LAN intranet, including ICMP ping?

Thank you.

[tiermutter]

Since inter-LAN traffic will never reach the sense there is no chance to do this on your Sense. You could use more interfaces, grouping devices and disallow traffic between interfaces. Another way would be using devices firewalls to block traffic from other LAN devices.

[CJ]

Another option is to do client isolation if you're using wifi.  But I really have to wonder about your use case.  What are you attempting to accomplish?

[xpking]

Another option is to do client isolation if you're using wifi.  But I really have to wonder about your use case.  What are you attempting to accomplish?

Yea, I am using the interface with wifi AP.
Your solution works! Thank you very much. 

[CJ]

Another option is to do client isolation if you're using wifi.  But I really have to wonder about your use case.  What are you attempting to accomplish?

Yea, I am using the interface with wifi AP.
Your solution works! Thank you very much. 

Glad that works for you, but can you elaborate on your use case?  What are you trying to accomplish that lead you to wanting this particular implementation?

[pasha-19]

I believe another option would be to block intravlan traffic in the switch with an ACL(s), if supported.  This would probably be more useful in the case where only partial intervlan traffic was to be blocked from certain devices while still allowing them access to the internet.